[NEW] [high] SAP Patch Day July 2026

highCVE-2025-68161 CVE-2026-0487 CVE-2026-24315 CVE-2026-27690 CVE-2026-33454 CVE-2026-40128

An attacker can exploit multiple vulnerabilities in SAP software to manipulate files, carry out a denial of service attack, disclose information, perform an SQL injection attack, conduct a cross-site scripting attack, bypass security measures, and execute arbitrary program code.

CSIRTS triage

vendor: SAP product: SAP software Denial of service Information disclosure SQL injection Cross-site scripting Authentication bypass

What: Multiple vulnerabilities in SAP software can be exploited to manipulate files, perform denial of service, disclose information, execute SQL injection, conduct cross-site scripting, bypass security measures, and execute arbitrary code.
Who is affected: Deployments of SAP software are affected by these vulnerabilities.
Urgency: Remediation is urgent due to the high severity and variety of potential impacts.
Action: Apply the latest security patches for SAP software.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch SAP software

Get an email when a new SAP software advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-07-29
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2308

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2025-681610.76% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 52% of all scored CVEs.
Low exploitation riskCVE-2026-04870.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all scored CVEs.
Low exploitation riskCVE-2026-243150.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all scored CVEs.
Low exploitation riskCVE-2026-276900.69% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all scored CVEs.
Low exploitation riskCVE-2026-334540.62% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 46% of all scored CVEs.
Low exploitation riskCVE-2026-401280.45% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all scored CVEs.
Moderate exploitation riskCVE-2026-404531.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 66% of all scored CVEs.
Moderate exploitation riskCVE-2026-408601.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 66% of all scored CVEs.
Moderate exploitation riskCVE-2026-412931.6% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 73% of all scored CVEs.
Moderate exploitation riskCVE-2026-435121.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 66% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2025-68161	coverage & exploitation status	NVD · CVE.org
CVE-2026-0487	coverage & exploitation status	NVD · CVE.org
CVE-2026-24315	coverage & exploitation status	NVD · CVE.org
CVE-2026-27690	coverage & exploitation status	NVD · CVE.org
CVE-2026-33454	coverage & exploitation status	NVD · CVE.org
CVE-2026-40128	coverage & exploitation status	NVD · CVE.org
CVE-2026-40453	coverage & exploitation status	NVD · CVE.org
CVE-2026-40860	coverage & exploitation status	NVD · CVE.org
CVE-2026-41293	coverage & exploitation status	NVD · CVE.org
CVE-2026-43512	coverage & exploitation status	NVD · CVE.org
CVE-2026-43515	coverage & exploitation status	NVD · CVE.org
CVE-2026-44745	coverage & exploitation status	NVD · CVE.org
CVE-2026-44747	coverage & exploitation status	NVD · CVE.org
CVE-2026-44752	coverage & exploitation status	NVD · CVE.org
CVE-2026-44753	coverage & exploitation status	NVD · CVE.org
CVE-2026-44759	coverage & exploitation status	NVD · CVE.org
CVE-2026-44760	coverage & exploitation status	NVD · CVE.org
CVE-2026-44761	coverage & exploitation status	NVD · CVE.org
CVE-2026-44767	coverage & exploitation status	NVD · CVE.org
CVE-2026-44768	coverage & exploitation status	NVD · CVE.org
CVE-2026-44769	coverage & exploitation status	NVD · CVE.org
CVE-2026-44770	coverage & exploitation status	NVD · CVE.org
CVE-2026-44771	coverage & exploitation status	NVD · CVE.org
CVE-2026-58233	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

low[UPDATE] [low] Apache log4j: Vulnerability allows information disclosurecert-bund
high[UPDATE] [high] Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira and Jira Service Management: …cert-bund
high[NEW] [high] Oracle Solaris third-party components: Multiple vulnerabilitiescert-bund
high[UPDATE] [high] Apache Tomcat: Multiple vulnerabilitiescert-bund
unknownMultiple vulnerabilities in Oracle Weblogic (July 23, 2026)cert-fr-avis
unknownMultiple vulnerabilities in Oracle MySQL (July 23, 2026)cert-fr-avis
unknownNCSC-2026-0257 [1.00] [M/H] Vulnerabilities fixed in Oracle Enterprise Managerncsc-nl
high[NEW] [high] Oracle Supply Chain: Multiple vulnerabilitiescert-bund
high[NEW] [high] Oracle Enterprise Manager: Multiple vulnerabilitiescert-bund
high[NEW] [high] Oracle Commerce: Multiple vulnerabilitiescert-bund
unknownNCSC-2026-0230 [1.01] [M/H] Vulnerabilities fixed in SAP productsncsc-nl
unknownUSN-8551-1: Tomcat vulnerabilitiesubuntu